15 unchanged sentences
In addition, we maintain a privacy risk management program to assess privacy risks related to how we are collecting, using, sharing, and storing user data, which is subject to assessment by an independent, third-party privacy assessor.
−Removed: We have certified against, and demonstrated conformance to, the International Organization for Standardization’s (“ ISO ”) information security management system audit using the 27701:2019 framework for the first time, and the 27001:2013, 27701:2019, and 27017:2015 frameworks.
−Removed: Successfully achieving these four certifications demonstrates our prioritization of security and privacy for both us and our customers and we believe shows that we have proper company-wide processes for managing operations, and maintaining people and information assets, information systems, and the associated processes that enable corporate operations.
−Removed: Our four ISO certifications add to the company’s overall resiliency strategy and commitment to security for all customers, which includes other accreditations including SOC 2 Type II, compliance with HITRUST CSF v11.0.1., CSA STAR, IRAP, FedRAMP and StateRAMP.
−Removed: Our privacy and security program dictates a governance structure whereby we:
+Added: We have certified against, and demonstrated conformance to, the latest International Organization for Standardization’s (“ISO”) information security management system audit using the 27001:2022, 27701:2019, and 27017:2015 frameworks.
+Added: Successfully achieving these three certifications demonstrates our prioritization of security and privacy for both us and our customers, and we believe shows that we have proper company-wide processes for managing operations, and maintaining people and information assets, information systems, and the associated processes that enable corporate operations.
+Added: Our three ISO certifications add to the company’s overall resiliency strategy and commitment to security for all customers, which includes other accreditations including SOC 2 Type II, compliance with HITRUST CSF v11.0.1., CSA STAR, IRAP and FedRAMP.
+Added: 33 Table of Contents Our privacy and security program dictates a governance structure whereby we:
● Regularly engage senior management on data privacy and security issues;
7 unchanged sentences
● Complete several cyber-specific audits per year;
−Removed: Engage consultants and other third parties in connection with our cybersecurity practices.
+Added: and ● Engage consultants and other third parties in connection with our cybersecurity practices.
Our internal audit function provides independent assessment and assurance on the overall operations of our cybersecurity and privacy programs and the supporting control frameworks.
1 unchanged sentence
Our risk mitigation strategies include a broad variety of technical and operational measures, as well as annual cybersecurity and privacy training for all of our employees.
−Removed: In addition, we maintain specific policies and practices governing our third-party security risks, including our third-party assessment (“ TPA ”) process.
−Removed: Under our TPA process, we gather information from certain third parties who contract with AvePoint and share or receive data, or have access to or integrate with our systems, in order to help us assess potential risks associated with their security controls.
−Removed: We also generally require third parties to maintain security controls to protect our confidential information and data, and notify us of material data breaches that may impact our data.
+Added: In addition, we maintain specific policies and practices governing our third -party security risks, including our third -party risk assessment (“ TPRA ”) process.
+Added: Under our TPRA process, we gather information from certain third parties who contract with AvePoint and share or receive data, or have access to or integrate with our systems, in order to help us assess potential risks associated with their security controls.
+Added: We also generally require third parties to maintain security controls to protect our confidential information and data, and to notify us of material data breaches that may impact our data.
Our Chief Risk, Privacy and Information Security Officer (“ CISO ”) leads the company’s privacy, data protection and security program.
−Removed: An expert in cyber and data security trends, our CISO has over twenty years of experience in the data protection field, was a founding member of the Women Leading Privacy Advisory Board and former member of the Education Advisory Board for the International Association of Privacy Professionals (IAPP) and in 2023, was named a finalist for the Women in IT Awards in the Security Leader of the Year category, included in the SIA Women in Security Power Forum 100 and named a Top Global CISO by Cyber Defense Magazine.
+Added: An expert in cyber and data security trends, our CISO has over twenty years of experience in the data protection field, was a founding member of the Women Leading Privacy Advisory Board and former member of the Education Advisory Board for the International Association of Privacy Professionals (IAPP) and has been a finalist for the Women in IT Awards in the Security Leader of the Year category, included in the SIA Women in Security Power Forum 100, featured in Forbes, and named a Top Global CISO by Cyber Defense Magazine.
+Added: including being featured in the "CSO Hall of Fame".
In addition, our CISO oversees teams across the company supporting our security and privacy functions of identify, prevent, detect, respond, and recover.
4 unchanged sentences
Disclosure of the Board ’ s Roles and Responsibilities
−Removed: Our Board of Directors oversees risks from cybersecurity threats using a multi-faceted approach that involves the Nominating and Corporate Governance Committee and various executive roles.
+Added: Our Board oversees risks from cybersecurity threats using a multi-faceted approach that involves the Nominating and Corporate Governance Committee and various executive roles.
Additionally, our CISO and Chief Compliance Officer regularly report on cybersecurity matters to the Board, as discussed above.
12 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.